|
| 1 | +--- |
| 2 | +title: Supabase 🤝 FastMCP |
| 3 | +sidebarTitle: Supabase |
| 4 | +description: Secure your FastMCP server with Supabase Auth |
| 5 | +icon: shield-check |
| 6 | +tag: NEW |
| 7 | +--- |
| 8 | + |
| 9 | +import { VersionBadge } from "/snippets/version-badge.mdx" |
| 10 | + |
| 11 | +<VersionBadge version="2.13.0" /> |
| 12 | + |
| 13 | +This guide shows you how to secure your FastMCP server using **Supabase Auth**. This integration uses the [**Remote OAuth**](/servers/auth/remote-oauth) pattern, where Supabase handles user authentication and your FastMCP server validates the tokens. |
| 14 | + |
| 15 | +## Configuration |
| 16 | + |
| 17 | +### Prerequisites |
| 18 | + |
| 19 | +Before you begin, you will need: |
| 20 | +1. A **[Supabase Account](https://supabase.com/)** with a project |
| 21 | +2. Your FastMCP server's URL (can be localhost for development, e.g., `http://localhost:8000`) |
| 22 | + |
| 23 | +### Step 1: Get Supabase Project URL |
| 24 | + |
| 25 | +In your Supabase Dashboard: |
| 26 | +1. Go to **Project Settings** |
| 27 | +2. Copy your **Project URL** (e.g., `https://abc123.supabase.co`) |
| 28 | + |
| 29 | +### Step 2: FastMCP Configuration |
| 30 | + |
| 31 | +Create your FastMCP server using the `SupabaseProvider`: |
| 32 | + |
| 33 | +```python server.py |
| 34 | +from fastmcp import FastMCP |
| 35 | +from fastmcp.server.auth.providers.supabase import SupabaseProvider |
| 36 | + |
| 37 | +# Configure Supabase Auth |
| 38 | +auth = SupabaseProvider( |
| 39 | + project_url="https://abc123.supabase.co", |
| 40 | + base_url="http://localhost:8000" |
| 41 | +) |
| 42 | + |
| 43 | +mcp = FastMCP("Supabase Protected Server", auth=auth) |
| 44 | + |
| 45 | +@mcp.tool |
| 46 | +def protected_tool(message: str) -> str: |
| 47 | + """This tool requires authentication.""" |
| 48 | + return f"Authenticated user says: {message}" |
| 49 | + |
| 50 | +if __name__ == "__main__": |
| 51 | + mcp.run(transport="http", port=8000) |
| 52 | +``` |
| 53 | + |
| 54 | +## Testing |
| 55 | + |
| 56 | +### Running the Server |
| 57 | + |
| 58 | +Start your FastMCP server with HTTP transport to enable OAuth flows: |
| 59 | + |
| 60 | +```bash |
| 61 | +fastmcp run server.py --transport http --port 8000 |
| 62 | +``` |
| 63 | + |
| 64 | +Your server is now running and protected by Supabase authentication. |
| 65 | + |
| 66 | +### Testing with a Client |
| 67 | + |
| 68 | +Create a test client that authenticates with your Supabase-protected server: |
| 69 | + |
| 70 | +```python client.py |
| 71 | +from fastmcp import Client |
| 72 | +import asyncio |
| 73 | + |
| 74 | +async def main(): |
| 75 | + # The client will automatically handle Supabase OAuth |
| 76 | + async with Client("http://localhost:8000/mcp", auth="oauth") as client: |
| 77 | + # First-time connection will open Supabase login in your browser |
| 78 | + print("✓ Authenticated with Supabase!") |
| 79 | + |
| 80 | + # Test the protected tool |
| 81 | + result = await client.call_tool("protected_tool", {"message": "Hello!"}) |
| 82 | + print(result) |
| 83 | + |
| 84 | +if __name__ == "__main__": |
| 85 | + asyncio.run(main()) |
| 86 | +``` |
| 87 | + |
| 88 | +When you run the client for the first time: |
| 89 | +1. Your browser will open to Supabase's authorization page |
| 90 | +2. After you authorize, you'll be redirected back |
| 91 | +3. The client receives the token and can make authenticated requests |
| 92 | + |
| 93 | +## Environment Variables |
| 94 | + |
| 95 | +For production deployments, use environment variables instead of hardcoding credentials. |
| 96 | + |
| 97 | +### Provider Selection |
| 98 | + |
| 99 | +Setting this environment variable allows the Supabase provider to be used automatically without explicitly instantiating it in code. |
| 100 | + |
| 101 | +<Card> |
| 102 | +<ParamField path="FASTMCP_SERVER_AUTH" default="Not set"> |
| 103 | +Set to `fastmcp.server.auth.providers.supabase.SupabaseProvider` to use Supabase authentication. |
| 104 | +</ParamField> |
| 105 | +</Card> |
| 106 | + |
| 107 | +### Supabase-Specific Configuration |
| 108 | + |
| 109 | +These environment variables provide default values for the Supabase provider, whether it's instantiated manually or configured via `FASTMCP_SERVER_AUTH`. |
| 110 | + |
| 111 | +<Card> |
| 112 | +<ParamField path="FASTMCP_SERVER_AUTH_SUPABASE_PROJECT_URL" required> |
| 113 | +Your Supabase project URL (e.g., `https://abc123.supabase.co`) |
| 114 | +</ParamField> |
| 115 | + |
| 116 | +<ParamField path="FASTMCP_SERVER_AUTH_SUPABASE_BASE_URL" required> |
| 117 | +Public URL of your FastMCP server (e.g., `https://your-server.com` or `http://localhost:8000` for development) |
| 118 | +</ParamField> |
| 119 | + |
| 120 | +<ParamField path="FASTMCP_SERVER_AUTH_SUPABASE_REQUIRED_SCOPES" default="[]"> |
| 121 | +Comma-, space-, or JSON-separated list of required OAuth scopes (e.g., `openid email` or `["openid", "email"]`) |
| 122 | +</ParamField> |
| 123 | +</Card> |
| 124 | + |
| 125 | +Example `.env` file: |
| 126 | +```bash |
| 127 | +# Use the Supabase provider |
| 128 | +FASTMCP_SERVER_AUTH=fastmcp.server.auth.providers.supabase.SupabaseProvider |
| 129 | + |
| 130 | +# Supabase configuration |
| 131 | +FASTMCP_SERVER_AUTH_SUPABASE_PROJECT_URL=https://abc123.supabase.co |
| 132 | +FASTMCP_SERVER_AUTH_SUPABASE_BASE_URL=https://your-server.com |
| 133 | +FASTMCP_SERVER_AUTH_SUPABASE_REQUIRED_SCOPES=openid,email |
| 134 | +``` |
| 135 | + |
| 136 | +With environment variables set, your server code simplifies to: |
| 137 | + |
| 138 | +```python server.py |
| 139 | +from fastmcp import FastMCP |
| 140 | + |
| 141 | +# Authentication is automatically configured from environment |
| 142 | +mcp = FastMCP(name="Supabase Protected Server") |
| 143 | +``` |
0 commit comments